A New Kind of Adversarial Example: Measuring the Human-Model Gap, and Its Relationship to OOD Detection

2026-07-21

AI Summary

This study reveals a human–model cognitive gap: when subjected to visibly perceptible perturbations, human recognition accuracy drops substantially (by approximately 49%), whereas deep models maintain near-perfect prediction accuracy. Through large-scale human experiments, CLIP zero-shot proxies, and Gaussian-controlled perturbation generation, the work systematically evaluates the effectiveness of mainstream out-of-distribution (OOD) detection, calibration, and defense methods. It provides the first empirical validation of this performance disparity, demonstrating that existing OOD detectors largely fail—only Mahalanobis distance shows partial efficacy, yet remains vulnerable to adaptive attacks—and that conventional defense strategies are ineffective. The analysis further indicates that such perturbations primarily disrupt texture rather than structural features.

Abstract

Almost all adversarial attacks add an imperceptible perturbation to fool a model. We instead study the opposite: a large, clearly visible perturbation that causes the model to keep its original, correct prediction, even though a human would no longer recognize the image. Prior work showed such examples can be generated at scale but left three questions untested: whether humans really perform worse than the model, whether standard out-of-distribution (OOD) detection and calibration tools catch it, and whether existing defenses mitigate it. We answer all three on MNIST, CIFAR-10, and ImageNet. (i) An independent recognizer proxy drops to ~49% on CIFAR-10 while the model stays at 100% -- a gap a small human pilot (N=5) corroborates directly and that is not explained by signal loss (a matched-magnitude Gaussian control degrades recognizability faster); a CLIP zero-shot proxy confirms the gap at ImageNet scale too. (ii) Confidence- and energy-based OOD detectors and calibration are structurally blind (0% detection, ECE ~= 0), while a feature-space Mahalanobis detector flags 100% -- but is evaded by an adaptive attacker at no cost to success. (iii) No classical defense, including adversarial training (45% robust accuracy), reduces attack success (correlation with large-epsilon_l resistance r ~= 0). A mechanistic analysis further shows the attack destroys low-level texture far faster than edge/shape structure.

Problem

• adversarial examples
• human-model gap
• out-of-distribution detection
• model robustness
• perceptible perturbations

Innovation

• adversarial examples
• human-model gap
• out-of-distribution detection
• robustness evaluation
• texture vs shape